{"id":91574,"date":"2020-08-14T19:42:27","date_gmt":"2020-08-14T17:42:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec"},"modified":"2020-08-14T19:42:27","modified_gmt":"2020-08-14T17:42:27","slug":"skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","title":{"rendered":"Hyrja e fsheht\u00eb e fjal\u00ebkalimeve me Smbexec","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Hyrja
\n
\nNe rrijemi shkruajm\u00eb rregullisht se si haker\u00ebt shpesh mb\u00ebshteten n\u00eb p\u00ebrdorimin metodave t\u00eb thyerjes pa kod t\u00eb d\u00ebmsh\u00ebm<\/a><\/noindex>, p\u00ebr t\u00eb evituar zbules\u00ebn. Ata n\u00eb t\u00eb v\u00ebrtet\u00eb \u00abmbijetojn\u00eb nga ushqimi i mbetur\u00bb<\/a><\/noindex>, duke p\u00ebrdorur mjete standarde t\u00eb Windows, duke anashkaluar antivirus\u00ebt dhe utilitat e tjera p\u00ebr zbulimin e aktivitetit t\u00eb d\u00ebmsh\u00ebm. Ne, si mbrojt\u00ebs, tani jemi t\u00eb detyruar t\u00eb p\u00ebrballemi me pasojat e trishtueshme t\u00eb k\u00ebtyre teknikave t\u00eb sofistikuara t\u00eb thyerjes: nj\u00eb punonj\u00ebs i vendosur n\u00eb m\u00ebnyr\u00eb t\u00eb p\u00ebrshtatshme mund t\u00eb p\u00ebrdor\u00eb t\u00eb nj\u00ebjtin qasje p\u00ebr t\u00eb vjedhur fshehurazi t\u00eb dh\u00ebnat (pron\u00ebsin\u00eb intelektuale t\u00eb kompanis\u00eb, numrat e kartave t\u00eb kreditit). Dhe n\u00ebse ai nuk nxitohet, por punon ngadal\u00eb dhe pa u v\u00ebn\u00eb re, do t\u00eb jet\u00eb jasht\u00ebzakonisht e v\u00ebshtir\u00eb - por megjithat\u00eb e mundshme n\u00ebse p\u00ebrdoren qasjet e duhura dhe p\u00ebrkat\u00ebse mjetet<\/a><\/noindex>, - p\u00ebr t\u00eb zbuluar nj\u00eb aktivitet t\u00eb till\u00eb.<\/p>\n

Nga ana tjet\u00ebr, nuk do t\u00eb doja ta demonizoj punonj\u00ebsit, pasi askush nuk d\u00ebshiron t\u00eb punoj\u00eb n\u00eb nj\u00eb ambient biznesi t\u00eb drejtuar nga \u00ab1984\u00bb i Orwell-it. P\u00ebr fat, ekzistojn\u00eb disa hapa praktik\u00eb dhe k\u00ebshilla q\u00eb mund t\u00eb komplikohet ndjesh\u00ebm jeta insid\u00ebrve. Ne do t\u00eb shqyrtojm\u00eb metodat e fshehta t\u00eb sulmeve<\/strong>, t\u00eb p\u00ebrdorura nga haker\u00ebt - punonj\u00ebs me nj\u00eb background teknik t\u00eb caktuar. Pak m\u00eb von\u00eb do t\u00eb diskutojm\u00eb mund\u00ebsit\u00eb p\u00ebr t\u00eb reduktuar k\u00ebto rreziqe \u2013 do t\u00eb shqyrtojm\u00eb si variantin teknik ashtu edhe at\u00eb organizativ.
\n<\/a><\/noindex><\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb e keqe me PsExec?<\/h2>\n

\nEdward Snowden, n\u00eb m\u00ebnyr\u00eb t\u00eb drejt\u00eb ose t\u00eb padrejt\u00eb, \u00ebsht\u00eb b\u00ebr\u00eb nj\u00eb sinonim p\u00ebr vjedhjen e t\u00eb dh\u00ebnave nga brenda. Po ashtu, mos harroni t\u00eb shqyrtoni k\u00ebt\u00eb sh\u00ebnim <\/a><\/noindex>p\u00ebr insid\u00ebr\u00ebt e tjer\u00eb q\u00eb gjithashtu meritojn\u00eb nj\u00ebfar\u00eb statusi t\u00eb njohur. Nj\u00eb pik\u00eb e r\u00ebnd\u00ebsishme p\u00ebr metodologjit\u00eb q\u00eb p\u00ebrdori Snowden \u00ebsht\u00eb - aq sa e dim\u00eb, ai nuk instaloi <\/em>asnj\u00eb softuer t\u00eb jasht\u00ebm t\u00eb d\u00ebmsh\u00ebm!<\/p>\n

P\u00ebrkundrazi, Snowden p\u00ebrdori pak inxhinieri sociale dhe shfryt\u00ebzoi pozitat e tij si administrator sistemi p\u00ebr t\u00eb mbledhur fjal\u00ebkalime dhe p\u00ebr t\u00eb krijuar kredenciale. Asgj\u00eb e komplikuar - asnj\u00eb mimikatz<\/a><\/noindex>, sulme man-in-the-middle <\/a><\/noindex>ose metasploit<\/a><\/noindex>. <\/p>\n

Punonj\u00ebsit e organizatave nuk jan\u00eb gjithmon\u00eb n\u00eb pozita unike si Snowden, por nga koncepti i \u00abmbijetes\u00ebs nga ushqimi i mbetur\u00bb mund t\u00eb nxirren disa m\u00ebsime t\u00eb r\u00ebnd\u00ebsishme - mos kryeni asnj\u00eb veprim t\u00eb d\u00ebmsh\u00ebm q\u00eb mund t\u00eb zbuloni, dhe ve\u00e7an\u00ebrisht jeni t\u00eb kujdessh\u00ebm me p\u00ebrdorimin e kredencialeve. Mbani mend k\u00ebt\u00eb mendim.<\/p>\n

Psexec<\/a><\/noindex> dhe kusuri i tij crackmapexec <\/a><\/noindex>kan\u00eb b\u00ebr\u00eb nj\u00eb p\u00ebrshtypje t\u00eb madhe p\u00ebr nj\u00eb num\u00ebr t\u00eb konsideruesh\u00ebm pentestuesish, haker\u00ebsh dhe bloger\u00ebsh t\u00eb siguris\u00eb informatike. Dhe n\u00eb kombinim me mimikatz, psexec u lejon sulmuesve t\u00eb l\u00ebvizin brenda rrjetit pa nevoj\u00ebn p\u00ebr t\u00eb ditur fjal\u00ebkalimin n\u00eb form\u00eb t\u00eb hapur. <\/p>\n

Mimikatz kap hash-in NTLM nga procesi LSASS, dhe m\u00eb pas d\u00ebrgon nj\u00eb token ose kredenciale - e njohur si sulmi \u00abpass the hash\u00bb<\/strong> - n\u00eb psexec, duke i lejuar sulmuesit t\u00eb hyj\u00eb n\u00eb nj\u00eb server tjet\u00ebr n\u00eb em\u00ebr t\u00eb nj\u00eb <\/em>p\u00ebrdoruesi tjet\u00ebr. Dhe me \u00e7do l\u00ebvizje n\u00eb nj\u00eb server t\u00eb ri, sulmuesi mbledh kredenciale t\u00eb reja, duke zgjeruar mund\u00ebsit\u00eb e tij p\u00ebr t\u00eb gjetur p\u00ebrmbajtje t\u00eb disponueshme.<\/p>\n

Kur fillova s\u00eb pari t\u00eb punoj me psexec, m\u00eb dukej thjesht magjik \u2013 fal\u00eb Mark Russinovich<\/a><\/noindex>, zhvleft\u00ebsit t\u00eb gjenialsh\u00ebm t\u00eb psexec, - por un\u00eb gjithashtu e di p\u00ebr komponent\u00ebt e tij t\u00eb zhurmsh\u00ebm. <\/em>Ai nuk \u00ebsht\u00eb asnj\u00ebher\u00eb fshehur! <\/p>\n

Fakti i par\u00eb interesant mbi psexec \u00ebsht\u00eb se ai p\u00ebrdor nj\u00eb protokoll t\u00eb jasht\u00ebzakonsh\u00ebm t\u00eb transferimit t\u00eb skedar\u00ebve SMB <\/strong>nga Microsoft. Me an\u00eb t\u00eb SMB, psexec \u00e7on skedar\u00eb t\u00eb vegj\u00ebl binar\u00eb <\/em>n\u00eb sistemin e synuar, duke i vendosur ato n\u00eb dosjen C:Windows.<\/p>\n

M\u00eb pas, psexec krijon nj\u00eb sh\u00ebrbim Windows duke p\u00ebrdorur binarin e kopjuar dhe e aktivizon at\u00eb me nj\u00eb em\u00ebr shum\u00eb t\u00eb \u00abpapritur\u00bb PSEXECSVC. N\u00eb k\u00ebt\u00eb proces mund ta shihni t\u00eb gjith\u00eb k\u00ebt\u00eb, ashtu si un\u00eb, duke e v\u00ebzhguar makin\u00ebn e larg\u00ebt (shih m\u00eb posht\u00eb).<\/p>\n

\"Hyrja<\/p>\n

Vizitkarta e Psexec: sh\u00ebrbimi \u00abPSEXECSVC\u00bb. Ai aktivizon skedarin binar, i cili u vendos p\u00ebrmes SMB n\u00eb dosjen C:Windows.<\/em><\/p>\n

\nSi faz\u00eb p\u00ebrfundimtare, skedari binar i kopjuar hap nj\u00eb lidhje RPC<\/em> n\u00eb serverin e synuar dhe m\u00eb pas merr komanda t\u00eb kontrollit (n\u00eb default - p\u00ebrmes cmd-shell Windows), duke i ekzekutuar ato dhe duke e redirectuar input-in dhe output-in n\u00eb makin\u00ebn e sulmuesit. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, sulmuesi sheh nj\u00eb komand\u00eb t\u00eb thjesht\u00eb - ashtu si n\u00ebse do t\u00eb ishte lidhur drejtp\u00ebrdrejt. <\/p>\n

Nj\u00eb s\u00ebr\u00eb komponent\u00ebsh dhe nj\u00eb proces shum\u00eb t\u00eb zhurmsh\u00ebm!<\/p>\n

Mekanizmi kompleks i proceseve t\u00eb brendshme t\u00eb psexec shpjegon mesazhin q\u00eb m\u00eb ka hutuar gjat\u00eb testeve t\u00eb mia t\u00eb para disa vjet m\u00eb par\u00eb: \u00abDuke filluar PSEXECSVC \u2026\u00bb dhe pauz\u00ebn e m\u00ebtejshme p\u00ebrpara se t\u00eb shfaqej linja e komandave. <\/p>\n

\"Hyrja<\/p>\n

Psexec nga Impacket n\u00eb t\u00eb v\u00ebrtet\u00eb tregon se \u00e7far\u00eb ndodh \u00abn\u00ebn kapu\u00e7\u00bb.<\/em><\/p>\n

\nNuk \u00ebsht\u00eb \u00e7udi: psexec ka b\u00ebr\u00eb nj\u00eb sasi t\u00eb madhe pune \u00abn\u00ebn kapu\u00e7\u00bb. N\u00ebse jeni t\u00eb interesuar p\u00ebr nj\u00eb shpjegim m\u00eb t\u00eb detajuar, shikoni k\u00ebt\u00eb <\/a><\/noindex>me nj\u00eb p\u00ebrshkrim t\u00eb shk\u00eblqyer.<\/p>\n

Duket se kur p\u00ebrdoret si nj\u00eb mjet p\u00ebr administrimin e sistemeve, q\u00eb ishte q\u00ebllimi i tij fillestar <\/em>psexec, nuk ka asgj\u00eb t\u00eb frikshme n\u00eb \"zhurmimin\" e t\u00eb gjith\u00eb k\u00ebtyre mekanizmave t\u00eb Windows. P\u00ebr sulmuesin, megjithat\u00eb, psexec do t\u00eb krijoj\u00eb komplikaime, dhe p\u00ebr nj\u00eb brend\u00ebs t\u00eb kujdessh\u00ebm dhe inteligjent, si Snowden, psexec ose nj\u00eb utilitar i ngjash\u00ebm do t\u00eb jet\u00eb nj\u00eb rrezik shum\u00eb i madh.<\/p>\n

Dhe k\u00ebtu vjen Smbexec<\/h2>\n

\nSMB \u00ebsht\u00eb nj\u00eb m\u00ebnyr\u00eb e zgjuar dhe e fsheht\u00eb p\u00ebr t\u00eb transferuar skedar\u00eb midis server\u00ebve, dhe haker\u00ebt jan\u00eb infiltruar drejtp\u00ebrdrejt n\u00eb SMB q\u00eb prej koh\u00ebsh. Mendoj se t\u00eb gjith\u00eb e din\u00eb q\u00eb nuk duhet t\u00eb hapin <\/a><\/noindex>portat SMB 445 dhe 139 n\u00eb internet, apo jo?<\/p>\n

N\u00eb vitin 2013, n\u00eb Defcon, Eric Milman (brav0hax<\/a><\/noindex>) prezantoi smbexec<\/a><\/noindex>, n\u00eb m\u00ebnyr\u00eb q\u00eb testuesit e siguris\u00eb t\u00eb mund t\u00eb provojn\u00eb thyerjen e fsheht\u00eb t\u00eb SMB. Nuk e di t\u00eb gjith\u00eb historin\u00eb, por m\u00eb pas Impacket e p\u00ebrmir\u00ebsoi m\u00eb tej smbexec. N\u00eb t\u00eb v\u00ebrtet\u00eb, p\u00ebr testimin tim, shkarkova skritpot e Impacket n\u00eb Python me Github<\/a><\/noindex>.<\/p>\n

Ndryshe nga psexec, smbexec eviton <\/em>transferimin e nj\u00eb skedari binar t\u00eb mundsh\u00ebm t\u00eb identifikuesh\u00ebm n\u00eb makin\u00ebn q\u00eb \u00ebsht\u00eb objektiv. N\u00eb vend t\u00eb k\u00ebsaj, utilitari jeton krejt\u00ebsisht nga \"ushqimi\" duke ekzekutuar komand\u00ebn lokale<\/em> e komand\u00ebs Windows.<\/p>\n

K\u00ebto jan\u00eb veprimet e saj: d\u00ebrgon nj\u00eb komand\u00eb nga makina sulmuese p\u00ebrmes SMB n\u00eb nj\u00eb skedar t\u00eb ve\u00e7ant\u00eb hyr\u00ebs, dhe m\u00eb pas krijon dhe ekzekuton nj\u00eb komand\u00eb t\u00eb komplikuar (si nj\u00eb sh\u00ebrbim Windows) q\u00eb do t\u00eb duket e njohur p\u00ebr ata q\u00eb njihen me Linux. N\u00eb p\u00ebrmbledhje: ajo ekzekuton nj\u00eb shell t\u00eb natyrsh\u00ebm Windows cmd, direccionon daljen n\u00eb nj\u00eb skedar tjet\u00ebr dhe pastaj e dergon p\u00ebrs\u00ebri p\u00ebrmes SMB n\u00eb makin\u00ebn e sulmuesit. <\/p>\n

M\u00ebnyra m\u00eb e mir\u00eb p\u00ebr ta kuptuar k\u00ebt\u00eb do t\u00eb ishte t\u00eb studioj\u00eb komand\u00ebn q\u00eb arrita t\u00eb marr nga regjistri i ngjarjeve (shih m\u00eb posht\u00eb).<\/p>\n

\"Hyrja<\/p>\n

Nuk \u00ebsht\u00eb ky nj\u00eb rast fantastik i reriditjes s\u00eb hyrjes\/daljes? P\u00ebr m\u00eb tep\u00ebr, krijimi i nj\u00eb sh\u00ebrbimi ka identifikuesin e ngjarjes 7045.<\/em><\/p>\n

\nAshtu si psexec, ajo gjithashtu krijon nj\u00eb sh\u00ebrbim q\u00eb b\u00ebn t\u00eb gjith\u00eb pun\u00ebn, por sh\u00ebrbimi pastaj shihet<\/em> p\u00ebrdoret vet\u00ebm nj\u00eb her\u00eb p\u00ebr t\u00eb ekzekutuar komand\u00ebn dhe pastaj zhduket! Nj\u00eb punonj\u00ebs i siguris\u00eb informative q\u00eb v\u00ebzhgon makin\u00ebn e viktim\u00ebs nuk do t\u00eb jet\u00eb n\u00eb gjendje t\u00eb zbuloj\u00eb indikator\u00eb t\u00eb duksh\u00ebm <\/em>t\u00eb sulmit: nuk ka asnj\u00eb skedar t\u00eb d\u00ebmsh\u00ebm q\u00eb ekzekutohet, nuk krijohet asnj\u00eb sh\u00ebrbim i p\u00ebrhersh\u00ebm, dhe nuk ka prova p\u00ebr p\u00ebrdorimin e RPC, pasi SMB \u00ebsht\u00eb mjeti i vet\u00ebm i transferimit t\u00eb t\u00eb dh\u00ebnave. Gjeniale!<\/p>\n

Nga ana e sulmuesit, \u00ebsht\u00eb n\u00eb dispozicion nj\u00eb \"pseudo-shell\" me vonesa midis d\u00ebrgimit t\u00eb komand\u00ebs dhe marrjes s\u00eb p\u00ebrgjigjes. Por k\u00ebto jan\u00eb mjaft t\u00eb mjaftueshme p\u00ebr punonj\u00ebsin e keq, qoft\u00eb brenda ose nj\u00eb haker t\u00eb jasht\u00ebm, i cili tashm\u00eb ka nj\u00eb platform\u00eb, p\u00ebr t\u00eb filluar k\u00ebrkimin pas p\u00ebrmbajtjeve interesante.<\/p>\n

\"Hyrja
\n
\nP\u00ebr t\u00eb rikthyer t\u00eb dh\u00ebnat nga makina objektiv n\u00eb makin\u00ebn e sulmuesit, p\u00ebrdoret smbclient.<\/a><\/noindex>Po, \u00ebsht\u00eb po ajo Samba utilita<\/a><\/noindex>, por e riformatuar n\u00eb nj\u00eb skript Python nga Impacket. N\u00eb t\u00eb v\u00ebrtet\u00eb, smbclient ju lejon t\u00eb organizoni n\u00eb fsheht\u00ebsi transferimin e FTP mbi SMB.<\/p>\n

Le t\u00eb b\u00ebjm\u00eb nj\u00eb hap prapa dhe t\u00eb mendojm\u00eb se \u00e7far\u00eb mund t\u00eb sjell\u00eb kjo p\u00ebr nj\u00eb punonj\u00ebs. N\u00eb skenarin tim imagjinar, le t\u00eb themi q\u00eb nj\u00eb bloger, nj\u00eb analist financiar ose nj\u00eb k\u00ebshilltar t\u00eb siguris\u00eb me pages\u00eb t\u00eb lart\u00eb lejohet t\u00eb p\u00ebrdor\u00eb laptopin e saj personal p\u00ebr pun\u00eb. Si rezultat i nj\u00eb procesi magjik, ajo ofendohet me kompanin\u00eb dhe \"shkon n\u00eb rrug\u00eb t\u00eb gabuar\". N\u00eb var\u00ebsi t\u00eb sistemit operativ t\u00eb laptopit, ajo ose p\u00ebrdor versionin Python nga Impact, ose versionin Windows t\u00eb smbexec ose smbclient si nj\u00eb skedar .exe.<\/p>\n

Si Snowden, ajo m\u00ebson fjal\u00ebkalimin e nj\u00eb p\u00ebrdoruesi tjet\u00ebr duke e par\u00eb at\u00eb n\u00eb supe, ose i ndodh q\u00eb t\u00eb gjej\u00eb nj\u00eb skedar t\u00eb tekstit me fjal\u00ebkalimin. Dhe me k\u00ebto t\u00eb dh\u00ebna, ajo fillon t\u00eb k\u00ebrkoj\u00eb n\u00eb sistem n\u00eb nj\u00eb nivel m\u00eb t\u00eb lart\u00eb privilegji. <\/p>\n

Thyerja e DCC: nuk na nevojitet asnj\u00eb \"budalla\" Mimikatz<\/h2>\n

\nN\u00eb postimet e mia t\u00eb m\u00ebparshme q\u00eb kan\u00eb t\u00eb b\u00ebjn\u00eb me testimin e siguris\u00eb, un\u00eb kam p\u00ebrdorur shpesh mimikatz. Ky \u00ebsht\u00eb nj\u00eb mjet fantastik p\u00ebr kapjen e kredencialeve \u2014 NTLM-hesh dhe madje edhe fjal\u00ebkalimeve n\u00eb form\u00eb t\u00eb qart\u00eb, q\u00eb fshihen brenda laptop\u00ebve dhe presin t\u00eb p\u00ebrdoren.
\nKoh\u00ebt kan\u00eb ndryshuar. Mjetet e monitorimit jan\u00eb b\u00ebr\u00eb m\u00eb t\u00eb mira n\u00eb zbuluar dhe bllokuar mimikatz. Administratoret e siguris\u00eb informative gjithashtu kan\u00eb m\u00eb shum\u00eb mund\u00ebsi p\u00ebr t\u00eb reduktuar riskun e sulmeve t\u00eb tipit \"kaloni hashin\" (t\u00eb m\u00ebposhtmen \u2013 PtH).
\nPra, \u00e7far\u00eb duhet t\u00eb b\u00ebj\u00eb nj\u00eb punonj\u00ebs i men\u00e7ur p\u00ebr t\u00eb mbledhur kredenciale shtes\u00eb pa p\u00ebrdorur mimikatz?<\/p>\n

N\u00eb paket\u00ebn nga Impacket ka nj\u00eb utilitar t\u00eb quajtur secretsdump<\/a><\/noindex>, e cila nxjerr t\u00eb dh\u00ebnat e autentifikimit nga cache i Domain Credential Cache, ose shkurt DCC. Sa e kuptoj, n\u00ebse nj\u00eb p\u00ebrdorues i domain-it hyn n\u00eb server, por kontrolluesi i domain-it nuk \u00ebsht\u00eb i arritsh\u00ebm, DCC i lejon serverit t\u00eb autentifikoj\u00eb p\u00ebrdoruesin. N\u00eb t\u00eb gjitha rastet, secretsdump ju lejon t\u00eb nxirrni t\u00eb gjith\u00eb k\u00ebta hash-e n\u00ebse jan\u00eb t\u00eb disponuesh\u00ebm.<\/p>\n

Hash-et DCC jan\u00eb nuk jan\u00eb hash-et NTLM <\/em> dhe ato nuk mund t\u00eb p\u00ebrdoren p\u00ebr nj\u00eb sulm PtH.<\/em>.<\/p>\n

Mir\u00eb, mund t\u00eb provoni t'i thyeni ata p\u00ebr t\u00eb marr\u00eb fjal\u00ebkalimin origjinal. Megjithat\u00eb, Microsoft \u00ebsht\u00eb b\u00ebr\u00eb m\u00eb e zgjuar n\u00eb menaxhimin e DCC dhe ka qen\u00eb jasht\u00ebzakonisht e v\u00ebshtir\u00eb t\u00eb thyhen hash-et DCC. Po, ka hashcat<\/a><\/noindex>, 'shkaktari m\u00eb i shpejt\u00eb i fjal\u00ebkalimeve n\u00eb bot\u00eb', por k\u00ebrkon nj\u00eb GPU p\u00ebr t\u00eb punuar n\u00eb m\u00ebnyr\u00eb efektive.<\/p>\n

N\u00eb vend t\u00eb k\u00ebsaj, le t\u00eb mendojm\u00eb si Snowden. Nj\u00eb punonj\u00ebs mund t\u00eb b\u00ebj\u00eb inxhinieri sociale dhe ndoshta t\u00eb m\u00ebsoj\u00eb ndonj\u00eb informacion rreth personit, fjal\u00ebkalimi i t\u00eb cilit d\u00ebshiron t\u00eb thyej\u00eb. P\u00ebr shembull, t\u00eb m\u00ebsoj\u00eb n\u00ebse ndonj\u00ebher\u00eb \u00ebsht\u00eb thyese ndonj\u00eb llogari online t\u00eb k\u00ebtij personi dhe t\u00eb studioj\u00eb fjal\u00ebkalimin e tij n\u00eb t\u00eb hapur p\u00ebr ndonj\u00eb sugjerim. <\/p>\n

Dhe ky \u00ebsht\u00eb skenari q\u00eb kam vendosur t\u00eb ndjek. Le t\u00eb supozojm\u00eb se nj\u00eb insajder ka m\u00ebsuar se shefi i tij, Cruella, \u00ebsht\u00eb thyer disa her\u00eb n\u00eb faqe t\u00eb ndryshme. Pas analiz\u00ebs s\u00eb disa prej k\u00ebtyre fjal\u00ebkalimeve, ai kupton se Cruella preferon t\u00eb p\u00ebrdor\u00eb form\u00ebn e emrit t\u00eb ekipit t\u00eb bejzbollit 'Yankees' dhe vitin aktual q\u00eb e ndjek \u2013 'Yankees2015'.<\/p>\n

N\u00ebse tani po provoni ta riprodhoni k\u00ebt\u00eb n\u00eb sht\u00ebpi, mund t\u00eb shkarkoni nj\u00eb t\u00eb vog\u00ebl, 'C' kod<\/a><\/noindex>, q\u00eb implementon algoritmin e hash-it DCC dhe ta kompilon. John the Ripper<\/a><\/noindex>, p\u00ebr t'ju th\u00ebn\u00eb, shtoi mb\u00ebshtetje p\u00ebr DCC, k\u00ebshtu q\u00eb mund t\u00eb p\u00ebrdoret gjithashtu. Le t\u00eb supozojm\u00eb se insajderi nuk d\u00ebshiron t\u00eb merret me studimin e John the Ripper dhe e p\u00eblqen t\u00eb drejtoj\u00eb 'gcc' mbi kodin e vjet\u00ebr n\u00eb C.<\/p>\n

Duke luajtur rolin e insajderit, kam provuar disa kombinime t\u00eb ndryshme dhe n\u00eb fund arrita t\u00eb zbuloj se fjal\u00ebkalimi i Cruell\u00ebs \u00ebsht\u00eb 'Yankees2019' (shih m\u00eb posht\u00eb). Misioni i p\u00ebrfunduar!<\/p>\n

\"Hyrja<\/p>\n

Pak inxhinieri sociale, ca t\u00eb sakt\u00eb dhe nj\u00eb krip\u00eb Maltego \u2013 dhe ju jeni n\u00eb rrug\u00ebn tuaj p\u00ebr t\u00eb thyer hash-in DCC.<\/em><\/p>\n

Sugjeroj q\u00eb t\u00eb p\u00ebrfundojm\u00eb k\u00ebtu. Do t\u00eb rikthehemi n\u00eb k\u00ebt\u00eb \u00e7\u00ebshtje n\u00eb publikime t\u00eb tjera dhe do t\u00eb shqyrtojm\u00eb edhe m\u00eb shum\u00eb metoda t\u00eb ngadalta dhe t\u00eb fshehta t\u00eb sulmit, duke vazhduar p\u00ebr t\u00eb mb\u00ebshtetur nj\u00eb grup t\u00eb shk\u00eblqyer mjetesh nga Impacket.
\n
Burimi: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u044b \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0438\u0448\u0435\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0447\u0430\u0441\u0442\u043e \u043e\u043f\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430 \u0431\u0435\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u041e\u043d\u0438 \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u00ab\u0432\u044b\u0436\u0438\u0432\u0430\u044e\u0442 \u043d\u0430 \u043f\u043e\u0434\u043d\u043e\u0436\u043d\u043e\u043c \u043a\u043e\u0440\u043c\u0443\u00bb, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 Windows, \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u043e\u0431\u0445\u043e\u0434\u044f \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438. \u041c\u044b, \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u043d\u0438\u043a\u0438, \u0442\u0435\u043f\u0435\u0440\u044c \u0432\u044b\u043d\u0443\u0436\u0434\u0435\u043d\u044b \u0438\u043c\u0435\u0442\u044c \u0434\u0435\u043b\u043e \u0441 \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f\u043c\u0438 \u0442\u0430\u043a\u0438\u0445 \u0445\u0438\u0442\u0440\u044b\u0445 \u0442\u0435\u0445\u043d\u0438\u043a \u0432\u0437\u043b\u043e\u043c\u0430: \u0443\u0434\u0430\u0447\u043d\u043e \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91575,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91574","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Thyerje e fsheht\u00eb e fjal\u00ebkalimeve me Smbexec | ProHoster","description":"Ne shkojm\u00eb rregullisht p\u00ebr ato q\u00eb haker\u00ebt shpesh b\u00ebjn\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u044b\u0439 \u0432\u0437\u043b\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Smbexec | ProHoster","og:description":"\u041c\u044b \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043f\u0438\u0448\u0435\u043c \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0447\u0430\u0441\u0442\u043e.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/skrytyj-vzlom-parolej-s-pomoshhyu-smbexec","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-14T17:42:27+00:00","article:modified_time":"2020-08-14T17:42:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91574","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:25:22","updated":"2022-09-28 07:05:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=91574"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/91574\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/91575"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=91574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=91574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=91574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}